CVE-2025-55284

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

C

laude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation due to an overly broad allowlist of safe commands. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update received this fix automatically after release. Current users of Claude Code are unaffected, as versions prior to 1.0.24 are deprecated and have been forced to update.

References

Link	Resource
https://github.com/anthropics/claude-code/security/advisories/GHSA-x5gv-jw7f-j6xj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*

History

24 Oct 2025, 14:53

Type	Values Removed	Values Added
CPE		cpe:2.3:a:anthropic:claude_code::::::node.js::*
References	~~() https://github.com/anthropics/claude-code/security/advisories/GHSA-x5gv-jw7f-j6xj -~~	() https://github.com/anthropics/claude-code/security/advisories/GHSA-x5gv-jw7f-j6xj - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Anthropic Anthropic claude Code

18 Aug 2025, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-16 02:15

Updated : 2025-10-24 14:53

NVD link : CVE-2025-55284

Mitre link : CVE-2025-55284

CVE.ORG link : CVE-2025-55284

JSON object : View

Products Affected

claude_code

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-55284", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-16T02:15:24.637", "references": [{"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-x5gv-jw7f-j6xj", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Claude Code is an agentic coding tool. Prior to version 1.0.4, it's possible to bypass the Claude Code confirmation prompts to read a file and then send file contents over the network without user confirmation due to an overly broad allowlist of safe commands. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update received this fix automatically after release. Current users of Claude Code are unaffected, as versions prior to 1.0.24 are deprecated and have been forced to update."}, {"lang": "es", "value": "Claude Code es una herramienta de codificaci\u00f3n agentica. Antes de la versi\u00f3n 1.0.4, era posible omitir las solicitudes de confirmaci\u00f3n de Claude Code para leer un archivo y luego enviar su contenido por la red sin la confirmaci\u00f3n del usuario debido a una lista de comandos seguros demasiado amplia. Para explotar esto de forma fiable, es necesario poder a\u00f1adir contenido no confiable a una ventana de contexto de Claude Code. Los usuarios con la actualizaci\u00f3n autom\u00e1tica est\u00e1ndar de Claude Code recibieron esta correcci\u00f3n autom\u00e1ticamente tras el lanzamiento. Los usuarios actuales de Claude Code no se ven afectados, ya que las versiones anteriores a la 1.0.24 est\u00e1n obsoletas y se han visto obligados a actualizar."}], "lastModified": "2025-10-24T14:53:13.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "72EE850D-B5FA-47C3-A35C-DC6DB4B54D3B", "versionEndExcluding": "1.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}